Why ISO 27001 and DSCR assurance matter for Leafnotes, and for the people who rely on us

October has been a sharp reminder of how much digital trust depends on other people's systems. Researchers found that the private keys behind eight eMudhra intermediate certificate authorities could be recovered from public data, and Google and Mozilla withdrew trust in them. Days later, PHP shipped emergency patches for two critical remote code execution flaws that affect default installations. Neither incident started with the organisations it exposed. That is how modern software works: your security depends on the whole ecosystem you rely on, and on how quickly and methodically you respond when part of it fails.

For Leafnotes, the stakes are higher. Our customers trust us with information about the people they care for. In our world, a security failure is more than an inconvenience. It can affect someone's care.

Building on a strong foundation

We aren't starting from scratch. Leafnotes already holds Cyber Essentials Plus and meets the NHS Data Security and Protection Toolkit standards, and our controls compare well with the best in our sector. But a certification that checks a single point in time only tells part of the story. We want assurance that is continuous, independently audited and built into how we work every day.

Why ISO 27001

ISO 27001 is the international standard for managing information security. It doesn't just ask for a fixed list of technical controls. It requires us to identify our risks, decide how to handle each one, and prove to an external auditor every year that those decisions are working. It covers people, processes and suppliers as well as technology. That matters because incidents like eMudhra start in third-party dependencies you don't directly control. With certification, our customers don't have to take our word for it.

Why DSCR assurance

Getting onto the Digital Social Care Records Assured Solutions List is the natural next step. Assurance tells care providers, commissioners and local authorities that Leafnotes meets the national standards a digital care record is expected to meet for security, interoperability and clinical safety. For providers, choosing an assured solution makes procurement simpler. It also gives confidence that the system at the heart of their service has been properly scrutinised.

Clinical safety at the centre

As part of this work, Dean McShane is becoming our Clinical Safety Officer. Dean will oversee how we identify, assess and reduce clinical safety risks in line with DCB0129, the NHS clinical risk management standard. Every new feature will be judged on what it does, and also on what could go wrong and who could be affected.

What this means for our customers

In practice, customers can expect:

• a clearer view of how we protect their data
• faster, more structured responses to new threats
• tighter oversight of our suppliers
• independent evidence they can share with their own regulators and auditors

Security is never finished. Threats will keep changing, and so will we. ISO 27001 and DSCR assurance give our commitment structure, accountability and outside proof. That's what our customers deserve.